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Amendments to the Claims 



1. (ORIGINAL) A method of generating successive round keys of an 
expanded key from an initial cryptographic key for use in an encryption and/or 
decryption engine, comprising the steps of: 

storing the Nk words of the initial key in Nk locations of a memory; 

providing the initial key to a cryptographic engine for performing a first 
cryptographic round; 

repeatedly retrieving a selected first word and a selected second word of the 
expanded key, at least one of which is retrieved from the memory, and generating 
fi-om the selected first and second words a successive subsequent word of the 
expanded key; 

providing the generated words of the expanded key to the cryptographic 
engine as round keys for performing subsequent cryptographic rounds; and 

storing successive ones of the generated subsequent words in the memory by 
cyclically overwriting previously generated words of the expanded key. 

2. (ORIGINAL) The method of claim 1 in which the step of overwriting 
previously generated words only occurs after those words have been used as said first 
and/or said second selected words in the step of generating a respective subsequent 
word. 

3. (ORIGINAL) The method of claim 1 in which the number of memory 
locations used is less than the number of words in the expanded key. 

4. (ORIGINAL) The method of claim 1 in which the number of memory 
locations used is equal to Nk. 

5. (ORIGINAL) The method of claim 4 in which the words of the initial 
key are also overwritten by words of the expanded key during the overwriting step. 

6. (ORIGINAL) The method of claim 1 in which the number of memory 
locations used is equal to 2Nk. 

7. (ORIGINAL) The method of claim 1 in which the memory is divided 
into two parts, a first part storing the initial key and the second part receiving the 
successively generated words of the expanded key. 

8. (ORIGINAL) The method of claim 7 fiirther including the step of 
completing generation of the expanded key such that the final round key is stored in 
the second part of the memory and the initial key is still stored in the first part of the 
memory. 

9. (ORIGINAL) The method of claim 8 fiirther including the step of 
performing a repeat key expansion starting with the initial key stored in the first part 
of the memory. 
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10. (ORIGINAL) The method of claim 8 further including the step of 
performing an inverse key expansion starting with the final round key stored in the 
second part of the memory. 

11. (CURRENTLY AMENDED) The method of any one of claima 1 to 
4claim 1 further including the step of completing generation of the expanded key such 
that the final round key is stored in the memory and the initial key has been 
overwritten. 

12. (ORIGINAL) The method of claim 11 fiirther including the step of 
performing an inverse key expansion starting with the final round key stored in the 
memory in order to regenerate the initial key for a subsequent cryptographic 
operation. 

13. (ORIGINAL) The method of claim 7 in which the number of memory 
locations used is equal to 2Nk, the first and the second parts having Nk locations 
each. 

14. (ORIGINAL) The method of any preceding claim in which the step of 
generating successive subsequent words of the expanded key comprises generating 
successive words of the AES Rijndael block cipher round keys according to the AES 
key expansion function. 

15. (ORIGINAL) The method of claim 14 in which Nk = 8. 

16. (CURRENTLY AMENDED) The method of any preceding claim claim 
i in which the successive subsequent words of the expanded key comprise words of 
encryption round keys. 

17. (CURRENTLY AMENDED) The method of any one of claims 1 to 
4 ^claim 1 in which the successive subsequent words of the expanded key comprise 
words of decryption roxmd keys. 

18. (ORIGINAL) The method of claim 1 in which the step of providing 
the generated words of the expanded key to the cryptographic engine comprises 
providing the words on a word-by-word basis as the cryptographic engine consumes 
the words as round keys. 

19. (ORIGINAL) The method of claim 1 in which, in the retrieving step, 
both the selected first word and the selected second word are retrieved from the 
memory. 

20. (ORIGINAL) The method of claim 1 in which, in the retrieving step, 
the selected first word is retrieved from memory and the selected second word is 
retrieved from a register used in a previous iteration. 

21. (ORIGINAL) The method of claim 1 in which the step of providing 
the generated words of the expanded key to the cryptographic engine comprises 
providing said generated words from the memory. 
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22. (ORIGINAL) The method of claim 1 in which the step of generating 
includes, in at least some cycles of round key word generation, the step of performing 
an S-box transform using an S-box shared with the cryptographic engine. 

23. (ORIGINAL) The method of claim 22 further including the step of 
maintaining synchronism of the generation of successive roimd key words with 
consumption of the round key words by the crj^jtographic engine. 

24. (ORIGINAL) A round key generator for generating successive round 
keys of an expanded key from an initial cryptographic key for use in an encryption 
and/or decryption engine, comprising: 

a memory for storing the Nk words of the initial key; 

an expansion processor for repeatedly retrieving a selected first word and a 
selected second word of the expanded key, at least one of which is retrieved from the 
memory, and generating from the selected first and second words a successive 
subsequent word of the expanded key; 

means for providing the generated words of the expanded key to the 
cryptographic engine as round keys for performing subsequent cryptographic rounds; 

means for storing successive ones of the generated subsequent words in the 
memory by cyclically overwriting previously generated words of the expanded key. 

25. (ORIGINAL) The apparatus of claim 24 further including control 
means for ensuring previously generated words are overwritten only after those words 
have been used as said first and/or said second selected words by the expansion 
processor. 

26. (ORIGINAL) The apparatus of claim 24 in which the number of word 
locations in memory is less than the number of words in the expanded key. 

27. (ORIGINAL) The apparatus of claim 24 in which the number of word 
locations in the memory is equal to Nk. 

28. (ORIGINAL) The apparatus of claim 27 in which the words of the 
initial key are also overwritten by words of the expanded key during the overwriting. 

29. (ORIGINAL) The apparatus of claim 24 in which the number of word 
locations in the memory is equal to 2Nk. 

30. (ORIGINAL) The apparatus of claim 24 in which the memory is 
divided into two parts, a first part storing the initial key and the second part receiving 
the successively generated words of the expanded key. 

31. (ORIGINAL) The apparatus of claim 30 in which the means for 
storing stores the final round key in the second part of the memory and retains the 
initial key in the first part of the memory after completion of generation of the 
expanded key. 

32. (ORIGINAL) The apparatus of claim 31 further including means for 
performing a repeat key expansion starting with the initial key stored in the first part 
of the memory. 
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33. (ORIGINAL) The apparatus of claim 31 further including means for 
performing an inverse key expansion starting with the final round key stored in the 
second part of the memory. 

34. (CURRENTLY AMENDED) The apparatus of any ono of claimo 21 to 
37 claim 24 further including means for completing generation of the expanded key 
such that the final roxmd key is stored in the memory and the initial key has been 
overwritten. 

35. (ORIGINAL) The apparatus of claim 34 further including means for 
performing an inverse key expansion starting with the final round key stored in the 
memory in order to regenerate the initial key for a subsequent cryptographic 
operation. 

36. (ORIGINAL) The apparatus of claim 30 in which the number of word 
locations in memory is equal to 2Nk, the first and the second parts having Nk 
locations each. 

37. (CURRENTLY AMENDED) The apparatus of aey — preceding 
ekif aclaim 24 in which the expansion processor includes means for generating 
successive words of the AES Rijndael block cipher round keys according to the AES 
key expansion function. 

38. (ORIGINAL) The apparatus of claim 37 in which Nk = 8. 

39. (CURRENTLY AMENDED) The apparatus of any — preceding 
etak nclaim 24 in which the expansion processor generates words of encryption round 
keys. 

40. (CURRENTLY AMENDED) The apparatus of any on e of claims 21 to 
58clami_24 in which the expansion key processor generates words of decryption 
round keys. 

4L (ORIGINAL) The apparatus of claim 24 further including a 
cryptographic engine, and means for providing the generated words of the expanded 
key to the cryptographic engine on a word-by-word basis as the cryptographic engine 
consumes the words as round keys. 

42. (ORIGINAL) The apparatus of claim 24 further including means for 
retrieving both the selected first word and the selected second word from the memory. 

43. (ORIGINAL) The apparatus of claim 24 further including means for 
retrieving the selected first word fi-om memory and the selected second word from a 
register in the expansion processor. 

44. (CURRENTLY AMENDED) The apparatus of eiai*H-4claim_2^ | 
including a cryptographic engine, in which the expansion processor and the 
cryptographic engine share an S-box. 
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45. (ORIGINAL) The apparatus of claim 44 further including the means 
for maintaining synchronism of the expansion processor and the cryptographic 
engine. 

46. (CURRENTLY AMENDED) A smart card incorporating the round key 
generator according to any one of claims 21 to 45 c iaim 24 . 

47. (ORIGINAL) A method of generating successive round key words of an 
expanded key, from an initial key, which method maintains the generated successive 
round key words in memory substantially only as long as they are required for use in 
the generation of successive round key words and for use in the parallel operation of 
a cryptographic process. 

48. (ORIGINAL) The method of claim 47 in which the initial key words 
are also maintained in the memory during the entire process of generating the 
expanded key. 

49. (ORIGINAL) An AES round constant function generator comprising a 
shift register having: 

a first control input for causing a left shift of the register contents; 
a second control input for causing a right shift of the register contents; and 
a third control input for causing a preset of the shift register contents to one of 
several possible values. 

50. (ORIGINAL) The apparatus of claim 49 in which the third control 
input causes a preset of the shift register contents to a value that is determined 
according to the current contents of the register. 

5L (ORIGINAL) The apparatus of claim 49 in which the several possible 
values are 01, IB, 36, 80 and 40 in hexadecimal. 

52. (ORIGINAL) The apparatus of claim 49 in which the first control 
input is asserted once for each round of an AES encryption operation, and in which 
the second control input is asserted once for each round of an AES decryption 
operation. 

53. (CANCEL) Apparatus — substantially — as — described — hefem — with 

roforoncc to the accompanying drawings. 

54. (CANCEL) A — method — substantially — as — de s cribed — herein — with 

r e f e renc e to th e accompanying drawings. 
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